Revision: 20251
Author: [email protected]
Date: Tue Mar 25 14:14:58 2014 UTC
Log: Don't convert dictionary sloppy arguments to fast double mode.
BUG=
[email protected]
Review URL: https://codereview.chromium.org/207683006
http://code.google.com/p/v8/source/detail?r=20251
Added:
/branches/bleeding_edge/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
Modified:
/branches/bleeding_edge/src/objects.cc
=======================================
--- /dev/null
+++
/branches/bleeding_edge/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
Tue Mar 25 14:14:58 2014 UTC
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b) {
+ for (var i = 10000; i > 0; i--) {
+ arguments[i] = 0;
+ }
+}
+
+f(1.5, 2.5);
=======================================
--- /branches/bleeding_edge/src/objects.cc Tue Mar 25 14:12:58 2014 UTC
+++ /branches/bleeding_edge/src/objects.cc Tue Mar 25 14:14:58 2014 UTC
@@ -11238,6 +11238,7 @@
}
ElementsKind elements_kind = GetElementsKind();
+ CHECK(elements_kind != SLOPPY_ARGUMENTS_ELEMENTS);
ElementsKind new_elements_kind = elements_kind;
if (IsHoleyElementsKind(elements_kind)) {
new_elements_kind = FAST_HOLEY_DOUBLE_ELEMENTS;
@@ -11257,13 +11258,9 @@
accessor->CopyElements(this, elems, elements_kind);
if (maybe_obj->IsFailure()) return maybe_obj;
}
- if (elements_kind != SLOPPY_ARGUMENTS_ELEMENTS) {
- ValidateElements();
- set_map_and_elements(new_map, elems);
- } else {
- FixedArray* parameter_map = FixedArray::cast(old_elements);
- parameter_map->set(1, elems);
- }
+
+ ValidateElements();
+ set_map_and_elements(new_map, elems);
if (FLAG_trace_elements_transitions) {
PrintElementsTransition(stdout, elements_kind, old_elements,
@@ -13124,6 +13121,7 @@
bool JSObject::ShouldConvertToFastDoubleElements(
bool* has_smi_only_elements) {
*has_smi_only_elements = false;
+ if (HasSloppyArgumentsElements()) return false;
if (FLAG_unbox_double_arrays) {
ASSERT(HasDictionaryElements());
SeededNumberDictionary* dictionary = element_dictionary();
--
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
---
You received this message because you are subscribed to the Google Groups "v8-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
